MilleGPG5 5.9.2 (Gennaio 2023) - Local Privilege Escalation / Incorrect Access Control

Exploit Title: MilleGPG5 5.9.2 Gennaio 2023 - Local Privilege Escalation / Incorrect Access Control Date: 2023-04-28 Exploit Author: Andrea Intilangelo Vendor Homepage: https://millegpg.it/ Software Homepage: https://millegpg.it - https://millewin.it/prodotti/governo-clinico-3/ Software Link:...

WordPress Emails & Newsletters with Jackmail Plugin <= 1.2.22 is vulnerable to CSV Injection

Software Emails & Newsletters with Jackmail Type Plugin Vulnerable versions = 1.2.22 Fixed in N/A OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2022-46821 Patch priority Low CVSS severity Low 5.8 Developer Claim ownership PSID 513c44c8232d Credits Mika Required privilege...

WordPress BizLibrary Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software BizLibrary Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0892 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 0d89568b8042 Credits Shreya Pohekar Required privilege...

WordPress Ad Inserter Plugin < 2.7.27 is vulnerable to PHP Object Injection

Software Ad Inserter Type Plugin Vulnerable versions 2.7.27 Fixed in 2.7.27 OWASP Top 10 A8: Insecure Deserialization Classification PHP Object Injection CVE CVE-2023-1549 Patch priority Low CVSS severity Low 4.4 Developer Igor Funa PSID 3b84de757ee4 Credits Nguyen Huu Do Required privilege...

WordPress User IP and Location Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)

Software User IP and Location Type Plugin Vulnerable versions = 2.2 Fixed in 2.2.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30780 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e801bae1a40a Credits deokhunKim Required...

WordPress Avirato hotels online booking engine Plugin <= 5.0.5 is vulnerable to SQL Injection

Software Avirato hotels online booking engine Type Plugin Vulnerable versions = 5.0.5 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0768 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 529cd2a74d04 Credits István Márton Required...

WordPress Shield Security Plugin <= 17.0.17 is vulnerable to Broken Access Control

Software Shield Security Type Plugin Vulnerable versions = 17.0.17 Fixed in 17.0.18 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0993 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID a6f498e522a5 Credits Ramuel Gall Required...

Medicine Tracker System 跨站脚本漏洞

Medicine Tracker System is a drug tracking system by Carlo Montero Personal Developer. A security vulnerability exists in Medicine Tracker System version 1.0.0. An attacker could exploit this vulnerability to conduct a cross-site scripting attack via page=about...

WordPress Mocho Blog Theme <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)

Software Mocho Blog Type Theme Vulnerable versions = 1.0.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-27412 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 085597533752 Credits László Radnai Required...

WordPress Logo Scheduler Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Software Logo Scheduler Type Plugin Vulnerable versions = 1.2.0 Fixed in 1.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30875 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 576e4137e757 Credits Yuki Haruma Required...

WordPress CRM Memberships Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)

Software CRM Memberships Type Plugin Vulnerable versions = 2.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-27427 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 152ce6558832 Credits Pavitra Tiwari Required...

WordPress Woocommerce Tip/Donation Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)

Software Woocommerce Tip/Donation Type Plugin Vulnerable versions = 1.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28783 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID db97e6af212a Credits Yuki Haruma Requir...

WordPress Plugin WPCode Lite 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

PT-2023-21374 · Unknown · Rails-Routes-To-Json

Name of the Vulnerable Software and Affected Versions: rails-routes-to-json version 1.0.0 Description: The issue is related to a remote code execution RCE vulnerability via the child process function. Recommendations: For rails-routes-to-json version 1.0.0, consider disabling the child process...

WordPress Video XML Sitemap Generator Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Video XML Sitemap Generator Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-31089 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6aa1b47a308e Credits Mika...

WordPress Elementor Website Builder Plugin <= 3.12.1 is vulnerable to SQL Injection

Software Elementor Website Builder Type Plugin Vulnerable versions = 3.12.1 Fixed in 3.12.2 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0329 Patch priority Low CVSS severity Low 6.6 Developer Elementor PSID c642fe631d89 Credits Sanjay Das Required privilege Administrator...

WordPress Display custom fields in the frontend – Post and User Profile Fields Plugin <= 1.2.0 is vulnerable to Broken Access Control

Software Display custom fields in the frontend – Post and User Profile Fields Type Plugin Vulnerable versions = 1.2.0 Fixed in 1.2.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-31073 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PS...

WordPress Autoptimize Plugin <= 3.1.6 is vulnerable to Cross Site Scripting (XSS)

Software Autoptimize Type Plugin Vulnerable versions = 3.1.6 Fixed in 3.1.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 69abd8964012 Credits N/A Required privilege Administrator...

WordPress Redirect After Login Plugin <= 0.1.9 is vulnerable to Cross Site Scripting (XSS)

Software Redirect After Login Type Plugin Vulnerable versions = 0.1.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-27624 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 658b630826ef Credits Yuki Haruma Required...

WordPress Cab Grid Plugin <= 1.5.15 is vulnerable to Cross Site Scripting (XSS)

Software Cab Grid Type Plugin Vulnerable versions = 1.5.15 Fixed in 1.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28533 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b5fcc0bdddbf Credits Yuki Haruma Required privilege...